From 9f7fe1de8b0347b866e89e6aa6502d8ffb096506 Mon Sep 17 00:00:00 2001
From: "Nicholas J. Kain" <nicholas@kain.us>
Date: Sat, 13 Nov 2010 11:18:07 -0500
Subject: [PATCH] Use BPF to filter input on raw sockets.

---
 ndhc/socket.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/ndhc/socket.c b/ndhc/socket.c
index 38373c1..f7b0aad 100644
--- a/ndhc/socket.c
+++ b/ndhc/socket.c
@@ -33,8 +33,10 @@
 #include <features.h>
 #include <netpacket/packet.h>
 #include <net/ethernet.h>
+#include <linux/filter.h>
 #include "log.h"
 #include "strl.h"
+#include "dhcpd.h" /* For SERVER_PORT and CLIENT_PORT */
 
 int read_interface(char *interface, int *ifindex, uint32_t *addr,
                    unsigned char *arp)
@@ -130,6 +132,48 @@ int raw_socket(int ifindex)
     int fd;
     struct sockaddr_ll sock;
 
+    /*
+     * Comment:
+     *
+     *   I've selected not to see LL header, so BPF doesn't see it, too.
+     *   The filter may also pass non-IP and non-ARP packets, but we do
+     *   a more complete check when receiving the message in userspace.
+     *
+     * and filter shamelessly stolen from:
+     *
+     *   http://www.flamewarmaster.de/software/dhcpclient/
+     *
+     * There are a few other interesting ideas on that page (look under
+     * "Motivation").  Use of netlink events is most interesting.  Think
+     * of various network servers listening for events and reconfiguring.
+     * That would obsolete sending HUP signals and/or make use of restarts.
+     *
+     *  Copyright: 2006, 2007 Stefan Rompf <sux@loplof.de>.
+     *  License: GPL v2.
+     */
+#define SERVER_AND_CLIENT_PORTS  ((67 << 16) + 68)
+    static const struct sock_filter filter_instr[] = {
+        /* check for udp */
+        BPF_STMT(BPF_LD|BPF_B|BPF_ABS, 9),
+        BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, IPPROTO_UDP, 2, 0),     /* L5, L1, is UDP? */
+        /* ugly check for arp on ethernet-like and IPv4 */
+        BPF_STMT(BPF_LD|BPF_W|BPF_ABS, 2),                      /* L1: */
+        BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, 0x08000604, 3, 4),      /* L3, L4 */
+        /* skip IP header */
+        BPF_STMT(BPF_LDX|BPF_B|BPF_MSH, 0),                     /* L5: */
+        /* check udp source and destination ports */
+        BPF_STMT(BPF_LD|BPF_W|BPF_IND, 0),
+        BPF_JUMP(BPF_JMP|BPF_JEQ|BPF_K, SERVER_AND_CLIENT_PORTS, 0, 1),/* L3, L4 */
+        /* returns */
+        BPF_STMT(BPF_RET|BPF_K, 0x0fffffff ),                   /* L3: pass */
+        BPF_STMT(BPF_RET|BPF_K, 0),                             /* L4: reject */
+    };
+    static const struct sock_fprog filter_prog = {
+        .len = sizeof(filter_instr) / sizeof(filter_instr[0]),
+        /* casting const away: */
+        .filter = (struct sock_filter *) filter_instr,
+    };
+
     memset(&sock, 0, sizeof sock);
     log_line("Opening raw socket on ifindex %d", ifindex);
     if ((fd = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_IP))) < 0) {
@@ -137,6 +181,14 @@ int raw_socket(int ifindex)
         goto out;
     }
 
+    if (SERVER_PORT == 67 && CLIENT_PORT == 68) {
+        /* Use only if standard ports are in use */
+        /* Ignoring error (kernel may lack support for this) */
+        if (setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &filter_prog,
+                       sizeof filter_prog) >= 0)
+            log_line("Attached filter to raw socket fd %d", fd);
+    }
+
     sock.sll_family = AF_PACKET;
     sock.sll_protocol = htons(ETH_P_IP);
     sock.sll_ifindex = ifindex;